Uptime Report Research · Regulation tracker · Updated November 2026

State Privacy Laws 2026: 23 States Have One, but They Still Cover Fewer Than Half of Americans

State privacy laws now exist in 23 states: 19 are in force and 4 more (Oklahoma, Louisiana, Alabama and Vermont) were signed in 2026. Using Census 2025 population estimates, the laws in force cover 43.3% of Americans, rising to 47.6% in 2028. Three took effect in 2026: Indiana, Kentucky, Rhode Island.

19comprehensive state laws in force (Nov 2026)

+4signed in 2026, effective 2027 to 2028

43.3%of US residents covered today (47.6% in 2028)

8 of 19in-force laws still give a mandatory cure period

This tracker compares every US state comprehensive consumer privacy law on the points that decide whether a company is covered and what happens if it slips: the thresholds, the effective dates, the cure period, the consent rule for sensitive data, the universal opt-out requirement, who enforces, the maximum penalty and the exemptions. We read each value from the enacted act or the official code on the legislature’s own site, and a script checks 407 verbatim quotes against those saved texts. Many of the trackers that rank for this query still count 19 or 20 states.

Coverage over time: from one state in 2020 to under half the country

in force before 2026took effect in 2026signed, not yet in effect

Cumulative share of the US resident population (Census Bureau Vintage 2025 estimates, July 1, 2025) living in a state whose comprehensive privacy law is in effect, by statutory effective date. Hover a dot for the states.

California stood alone from 2020 to 2022. Virginia, Colorado, Connecticut and Utah followed in 2023, and the big jump came in 2024 and 2025, when Texas, Oregon, Montana and eight more states switched on. California and Texas alone hold 20.8% of the population, which is why the line moves so little after 2025: Indiana, Kentucky and Rhode Island added 3.7 points in 2026, and the four 2026 enactments add another 4.3. Even with all 23, about 179 million people live in states with no comprehensive law, including New York, Pennsylvania, Illinois, Ohio, Georgia, Michigan and North Carolina. Florida (6.9% of the population) has a law that reaches only companies with over $1 billion in revenue.

in force (year)in force from 2026signed 2026 (effective year)none

Which state privacy laws took effect in 2026, and what changed

Three new laws switched on January 1, 2026: Indiana, Kentucky and Rhode Island. Indiana and Kentucky use Virginia’s thresholds (100,000 consumers, or 25,000 plus over 50% of revenue from data sales) and 30-day cure periods with no end date. Rhode Island has no cure provision at all and adds a fine of $100 to $500 for each intentional disclosure in violation of the act. But for companies already in scope, 2026 mattered more for what ended: mandatory cure periods expired in Oregon (January 1), Minnesota (January 31), Montana (April 1) and New Jersey (July 1), after Delaware and New Hampshire moved to discretionary cures on January 1. Connecticut’s amended thresholds, in force since July 1, 2026, widen its scope the most.

Date	State	Change	Source
Dec 31, 2025	Delaware and New Hampshire	Mandatory 60-day cure periods end; cures are discretionary from Jan 1, 2026	DE 12D-111(b), (c); RSA 507-H:11
Jan 1, 2026	Indiana, Kentucky, Rhode Island	New comprehensive laws take effect	IC 24-15; KRS 367.3611; R.I. Gen. Laws 6-48.1
Jan 1, 2026	Oregon	Universal opt-out signal becomes mandatory and the 30-day cure ends (Oregon Laws 2023, ch. 369, sec. 15)	SB 619 enrolled, sec. 15
Jan 1, 2026	Delaware	Opt-out preference signal must be honored	6 Del. C. 12D-106
Jan 31, 2026	Minnesota	30-day warning-letter cure expires	Minn. Stat. 325M.20(a)
Apr 1, 2026	Montana	60-day cure terminates	Ch. 681, L. 2023, sec. 15
Jul 1, 2026	Connecticut	Threshold cut to 35,000 consumers; any sensitive-data processing or data sale triggers coverage	P.A. 25-113
Jul 1, 2026	Maryland	Precise geolocation redefined to cover devices and vehicles; sales to certain immigration-enforcement units restricted	2026 Md. Laws ch. 874
Jul 1, 2026	New Jersey	30-day cure period ends (first day of the 18th month after the Jan 15, 2025 effective date)	P.L.2023, c.266, sec. 14
Dec 31, 2026	Colorado	Cure period for the minors’ provisions is repealed	C.R.S. 6-1-1311
Jan 1, 2027	Delaware	Thresholds fall to 10,000 consumers, or 5,000 plus over 20% of revenue from data sales	6 Del. C. 12D-103 [Effective Jan. 1, 2027]
Jan 1, 2027	Oklahoma, Louisiana	New laws take effect	SB 546; Act 502
Jan 1, 2027	California	Browsers must offer a consumer-configurable opt-out preference signal	Civ. Code 1798.136
May 1, 2027	Alabama	New law takes effect	HB 351, sec. 12
Jul 1, 2027	Kentucky	Amendments in 2026 Ky. Acts ch. 118 (HB 692) take effect	HB 692, sec. 3
Jan 1, 2028	Vermont	New law takes effect; 60-day cure runs to Jun 30, 2029	Act 145, secs. 3 and 4

Grey rows have already happened (as of November 1, 2026). All dates are from the enacted text or official code notes listed in References.

Comparison matrix: all 23 state privacy laws

One row per law, in order of effective date. Pink rows were signed in 2026 and are not yet in force. “Payment-only excluded” means data processed only to complete a payment transaction does not count toward the threshold.

State and citation	Effective	Applicability thresholds	Cure period	Sensitive data	Universal opt-out	Max civil penalty	Private right of action	Exemptions
California Cal. Civ. Code 1798.100 to 1798.199.100	Jan 1, 2020	Any one of: over $26,625,000 annual gross revenue (2025 CPI-adjusted from $25,000,000); buys, sells or shares personal information of 100,000+ consumers or households; or 50%+ of revenue from selling or sharing personal information	No mandatory cure; the CPPA may decide to give a business time to cure	Opt-out (right to limit use)	Required (CCPA regulations, section 7025); browsers must offer a signal from Jan 1, 2027	$2,500 per violation; $7,500 intentional or involving minors (statutory, CPI-adjusted)	Limited: data breaches caused by failure to keep reasonable security ($100 to $750 per consumer per incident, statutory)	GLBA: Data only HIPAA: Data only Nonprofits: Exempt (for-profit businesses only)
Virginia Va. Code 59.1-575 to 59.1-584	Jan 1, 2023	100,000 consumers, or 25,000 consumers plus over 50% of gross revenue from data sales	30 days, no end date	Opt-in consent; sale of precise geolocation banned	Not required	Up to $7,500 per violation	No	GLBA: Entity and data HIPAA: Entity and data Nonprofits: Exempt
Colorado C.R.S. 6-1-1301 to 6-1-1314	Jul 1, 2023	100,000 consumers, or 25,000 consumers plus any revenue or discount from data sales; biometric and minors’ duties apply below these thresholds	60 days until Jan 1, 2025 (a separate minors’ cure runs to Dec 31, 2026)	Opt-in consent	Required since Jul 1, 2024	Up to $20,000 per violation (6-1-112); each consumer or transaction counts separately	No	GLBA: Entity HIPAA: Data only Nonprofits: Covered (no exemption)
Connecticut Conn. Gen. Stat. 42-515 to 42-526	Jul 1, 2023	Since Jul 1, 2026: 35,000 consumers, or ANY processing of sensitive data, or ANY offer of personal data for sale	60 days until Dec 31, 2024; now at the Attorney General’s discretion	Opt-in consent (and must be reasonably necessary)	Required since Jan 1, 2025	Up to $5,000 per wilful violation (CUTPA 42-110o)	No	GLBA: Data (entity exemption narrowed Jul 1, 2026) HIPAA: Entity and data Nonprofits: Exempt
Utah Utah Code 13-61-101 to 13-61-504	Dec 31, 2023	$25 million revenue AND either 100,000 consumers or 25,000 consumers plus over 50% of gross revenue from data sales	30 days, no end date	Notice and opt-out	Not required	Up to $7,500 per violation, plus actual damages	No	GLBA: Entity and data HIPAA: Entity and data Nonprofits: Exempt
Oregon ORS 646A.570 to 646A.589	Jul 1, 2024	100,000 consumers (payment-only data excluded), or 25,000 consumers plus 25% or more of gross revenue from data sales; carmakers covered at any volume	30 days until Jan 1, 2026	Opt-in consent; sale of precise geolocation and under-16 data banned	Required since Jan 1, 2026	Up to $7,500 per violation	No	GLBA: Data (financial institutions exempt as entities) HIPAA: Data only Nonprofits: Covered since Jul 1, 2025
Texas Tex. Bus. and Com. Code ch. 541	Jul 1, 2024	No volume test: any business that processes or sells personal data and is not an SBA-defined small business (small businesses still need consent to sell sensitive data)	30 days, no end date	Opt-in consent	Required since Jan 1, 2025 (authorized agent via browser or device setting)	Up to $7,500 per violation	No	GLBA: Entity and data HIPAA: Entity Nonprofits: Exempt
Montana Mont. Code 30-14-2801 to 30-14-2819	Oct 1, 2024	25,000 consumers (payment-only data excluded), or 15,000 consumers plus over 25% of gross revenue from data sales (cut from 50,000 and 25,000 in 2025)	60 days; the cure provision terminated April 1, 2026	Opt-in consent	Required since Jan 1, 2025	Not set in the act; enforced with Consumer Protection Act powers	No	GLBA: Data (banks and credit unions exempt as entities) HIPAA: Entity and data Nonprofits: Covered (only insurance-fraud nonprofits exempt)
Delaware 6 Del. C. 12D-101 to 12D-111	Jan 1, 2025	35,000 consumers (payment-only excluded), or 10,000 plus over 20% of revenue from data sales; drops to 10,000 and 5,000 on Jan 1, 2027	60 days mandatory through Dec 31, 2025; now discretionary	Opt-in consent	Required since Jan 1, 2026	Up to $10,000 per wilful violation (6 Del. C. 2522)	No	GLBA: Entity and data HIPAA: Data only Nonprofits: Covered (only insurance-crime nonprofits exempt)
Iowa Iowa Code 715D.1 to 715D.9	Jan 1, 2025	100,000 consumers, or 25,000 consumers plus over 50% of gross revenue from data sales	90 days, no end date (longest cure of any state)	Notice and opt-out	Not required	Up to $7,500 per violation	No	GLBA: Entity and data HIPAA: Entity and data Nonprofits: Exempt
Nebraska Neb. Rev. Stat. 87-1101 to 87-1130	Jan 1, 2025	No volume test: any business that processes or sells personal data and is not an SBA-defined small business (small businesses still need consent to sell sensitive data)	30 days, no end date	Opt-in consent	Required (authorized agent via browser or device setting)	Up to $7,500 per violation	No	GLBA: Entity and data HIPAA: Entity and data Nonprofits: Exempt
New Hampshire N.H. RSA 507-H:1 to 507-H:12	Jan 1, 2025	35,000 unique consumers (payment-only excluded), or 10,000 plus over 25% of revenue from data sales	60 days mandatory through Dec 31, 2025; now discretionary	Opt-in consent	Required since Jan 1, 2025	Up to $10,000 per violation (RSA 358-A:4)	No	GLBA: Entity and data HIPAA: Entity Nonprofits: Exempt
New Jersey N.J.S.A. 56:8-166.4 et seq.	Jan 15, 2025	100,000 consumers (payment-only excluded), or 25,000 consumers plus any revenue or discount from data sales	30 days until the first day of the 18th month after the effective date (Jul 1, 2026)	Opt-in consent	Required since Jul 15, 2025 (six months after the effective date)	Consumer Fraud Act penalties (N.J.S.A. 56:8-1 et seq.)	No	GLBA: Entity and data HIPAA: Data only Nonprofits: Covered (no exemption)
Tennessee Tenn. Code 47-18-3201 to 47-18-3213	Jul 1, 2025	Over $25 million revenue AND either 175,000 consumers or 25,000 consumers plus over 50% of gross revenue from data sales	60 days, no end date	Opt-in consent	Not required	Up to $7,500 per violation; treble damages if wilful or knowing	No	GLBA: Entity and data HIPAA: Entity and data Nonprofits: Exempt
Minnesota Minn. Stat. 325M.10 to 325M.21	Jul 31, 2025	100,000 consumers (payment-only excluded), or 25,000 consumers plus over 25% of gross revenue from data sales; SBA small businesses exempt except a ban on selling sensitive data without consent	30-day warning letter until Jan 31, 2026	Opt-in consent	Required	Up to $7,500 per violation	No	GLBA: Data (banks and credit unions exempt as entities) HIPAA: Data only Nonprofits: Covered (only insurance-fraud nonprofits exempt)
Maryland Md. Code, Com. Law 14-4701 to 14-4714	Oct 1, 2025	35,000 consumers (payment-only excluded), or 10,000 consumers plus over 20% of revenue from data sales	At least 60 days if the Consumer Protection Division offers one, for violations through Apr 1, 2027	Strictly necessary only; sale of sensitive data banned	Required since Oct 1, 2025	Up to $10,000 per violation; $25,000 for repeats (MCPA 13-410)	No	GLBA: Entity and data HIPAA: Data only Nonprofits: Covered (narrow exemptions only)
Indiana Ind. Code 24-15	Jan 1, 2026	100,000 Indiana consumers, or 25,000 plus over 50% of gross revenue from data sales	30 days, no end date	Opt-in consent	Not required	Up to $7,500 per violation	No	GLBA: Entity and data HIPAA: Entity and data Nonprofits: Exempt
Kentucky KRS 367.3611 to 367.3629	Jan 1, 2026	100,000 consumers, or 25,000 consumers plus over 50% of gross revenue from data sales	30 days, no end date	Opt-in consent	Not required	Up to $7,500 per continued violation	No	GLBA: Entity and data HIPAA: Entity and data Nonprofits: Exempt
Rhode Island R.I. Gen. Laws 6-48.1-1 to 6-48.1-10	Jan 1, 2026	35,000 customers (payment-only excluded), or 10,000 plus over 20% of revenue from data sales; for-profit entities only	No cure provision	Opt-in consent	Not required	Up to $10,000 per violation (6-13.1-8), plus $100 to $500 per intentional disclosure	No	GLBA: Entity and data HIPAA: Entity Nonprofits: Exempt
Louisiana La. R.S. 51:1780.1 to 51:1780.5	Jan 1, 2027	Any one of: over $25 million annual gross revenue; 75,000+ consumers, households or devices bought, received, sold or shared; or 50%+ of revenue from selling personal information	30 days, only from Jan 1 to Jul 31, 2027	Opt-in consent	Required (authorized agent via browser or device setting)	Via Unfair Trade Practices Law: up to $5,000 per violation if intent to defraud	No (LUTPA private actions excluded)	GLBA: Entity and data HIPAA: Entity Nonprofits: Exempt
Oklahoma 75A O.S. 300 et seq.	Jan 1, 2027	100,000 consumers, or 25,000 consumers plus over 50% of gross revenue from data sales	30 days, no end date	Opt-in consent	Not required	Up to $7,500 per violation	No	GLBA: Entity and data HIPAA: Entity Nonprofits: Exempt
Alabama Ala. Acts 2026, HB 351	May 1, 2027	More than 25,000 consumers (payment-only excluded), or over 25% of gross revenue from data sales at any volume; firms under 500 employees that do not sell data are exempt	45 days, no end date	Opt-in consent	Not required (opt-out link or contact method)	Up to $15,000 per violation (highest base amount of any state)	Not addressed (AG enforcement only)	GLBA: Entity and data HIPAA: Entity Nonprofits: Exempt if under 100 employees and no data sales
Vermont 9 V.S.A. ch. 61A (2415a et seq.)	Jan 1, 2028	35,000 consumers (payment-only excluded), or sensitive data of 3,000 consumers, or personal data of 3,000 consumers offered for sale	60 days, Jan 1, 2028 to Jun 30, 2029	Opt-in consent (and reasonably necessary); consent to sell	Required	Via Consumer Protection Act: up to $10,000 per violation (9 V.S.A. 2458)	No	GLBA: Data (banks and credit unions exempt as entities) HIPAA: Entity (non-hybrid covered entities) Nonprofits: Covered (no general exemption)

Strictest and loosest thresholds

Strictest (easiest to fall into)

Texas and Nebraska have no consumer count: any business that processes or sells personal data and is not a small business under SBA size standards is covered, and small businesses still need consent to sell sensitive data.
Connecticut, since July 1, 2026: 35,000 consumers, or any processing of sensitive data, or any offer of personal data for sale.
Montana has the lowest count in force: 25,000 consumers, or 15,000 plus over 25% of revenue from data sales, after its 2025 amendments cut both numbers.
Delaware drops to 10,000 consumers (or 5,000 plus over 20% of revenue from sales) on January 1, 2027, and Vermont (2028) counts sensitive data or sales of just 3,000 consumers.

Loosest (hardest to trigger)

Tennessee: over $25 million in revenue AND either 175,000 consumers or 25,000 plus over 50% of revenue from data sales.
Utah: $25 million in revenue AND either 100,000 consumers or 25,000 plus over 50% from data sales. Sensitive data needs only notice and a chance to opt out.
Virginia, Iowa, Indiana, Kentucky, Oklahoma: 100,000 consumers or 25,000 plus over 50% from sales, with no revenue test.
California and Louisiana work the other way: revenue alone (over $26.6 million in California after the 2025 CPI adjustment, over $25 million in Louisiana) brings a company in, whatever its consumer count.

The penalties spread just as widely. Most laws cap civil penalties at $7,500 per violation, but Colorado allows up to $20,000 per violation and counts each consumer or transaction separately, and Alabama’s 2026 law sets up to $15,000. Only 8 in-force laws still promise a cure period with no end date: Virginia, Utah, Iowa, Indiana, Tennessee, Texas, Kentucky, Nebraska. Universal opt-out signals such as Global Privacy Control must be honored in 12 of the 19 states in force; the holdouts are Virginia, Utah, Iowa, Indiana, Tennessee, Kentucky, Rhode Island. Sensitive data needs opt-in consent almost everywhere; California, Utah, Iowa use an opt-out or notice model instead, and Maryland bans the sale of sensitive data outright.

Applicability checker

Not legal advice. This screen applies each law’s headline thresholds to the numbers you enter. It ignores many exemptions (GLBA, HIPAA, higher education, employee and B2B data and others), counts every resident equally, and treats California’s buy, sell or share count as a simple resident count. Use it to decide where to look closer, then read the statute or ask counsel.

All 23 laws: names, citations and enacting acts

State	Law	Citation	Enacting act	Effective	Population (2025)
Alabama	Alabama Personal Data Protection Act (HB 351)	Ala. Acts 2026, HB 351	HB 351 (2026)	May 1, 2027	5,193,088
California	California Consumer Privacy Act (as amended by the CPRA, Proposition 24)	Cal. Civ. Code 1798.100 to 1798.199.100	Stats. 2018, Ch. 55; Proposition 24 (2020)	Jan 1, 2020	39,355,309
Colorado	Colorado Privacy Act	C.R.S. 6-1-1301 to 6-1-1314	SB 21-190	Jul 1, 2023	6,012,561
Connecticut	Connecticut Data Privacy Act	Conn. Gen. Stat. 42-515 to 42-526	P.A. 22-15; amended by P.A. 25-113	Jul 1, 2023	3,688,496
Delaware	Delaware Personal Data Privacy Act	6 Del. C. 12D-101 to 12D-111	84 Del. Laws c. 197; amended 85 Del. Laws c. 463	Jan 1, 2025	1,059,952
Indiana	Indiana consumer data protection (IC 24-15)	Ind. Code 24-15	P.L. 94-2023	Jan 1, 2026	6,973,333
Iowa	Iowa consumer data protection (Iowa Code ch. 715D)	Iowa Code 715D.1 to 715D.9	2023 Iowa Acts, ch. 17	Jan 1, 2025	3,238,387
Kentucky	Kentucky Consumer Data Protection Act	KRS 367.3611 to 367.3629	2024 Ky. Acts ch. 72	Jan 1, 2026	4,606,864
Louisiana	Louisiana Data Privacy Act	La. R.S. 51:1780.1 to 51:1780.5	SB 386, Act 502 (2026)	Jan 1, 2027	4,618,189
Maryland	Maryland Online Data Privacy Act	Md. Code, Com. Law 14-4701 to 14-4714	2024 Md. Laws ch. 455 (SB 541)	Oct 1, 2025	6,265,347
Minnesota	Minnesota Consumer Data Privacy Act	Minn. Stat. 325M.10 to 325M.21	Laws 2024, ch. 121, art. 5	Jul 31, 2025	5,830,405
Montana	Consumer Data Privacy Act	Mont. Code 30-14-2801 to 30-14-2819	Ch. 681, L. 2023 (SB 384); amended Ch. 567, L. 2025	Oct 1, 2024	1,144,694
Nebraska	Data Privacy Act	Neb. Rev. Stat. 87-1101 to 87-1130	LB 1074 (2024)	Jan 1, 2025	2,018,006
New Hampshire	RSA 507-H (Expectation of Privacy)	N.H. RSA 507-H:1 to 507-H:12	Laws 2024, ch. 5	Jan 1, 2025	1,415,342
New Jersey	New Jersey consumer data privacy law (P.L.2023, c.266)	N.J.S.A. 56:8-166.4 et seq.	S332, P.L.2023, c.266	Jan 15, 2025	9,548,215
Oklahoma	Oklahoma consumer data privacy act (SB 546)	75A O.S. 300 et seq.	SB 546 (2026)	Jan 1, 2027	4,123,288
Oregon	Oregon Consumer Privacy Act	ORS 646A.570 to 646A.589	Oregon Laws 2023, ch. 369 (SB 619)	Jul 1, 2024	4,273,586
Rhode Island	Rhode Island Data Transparency and Privacy Protection Act	R.I. Gen. Laws 6-48.1-1 to 6-48.1-10	P.L. 2024, ch. 430 and ch. 453	Jan 1, 2026	1,114,521
Tennessee	Tennessee Information Protection Act	Tenn. Code 47-18-3201 to 47-18-3213	Public Chapter 408 (2023)	Jul 1, 2025	7,315,076
Texas	Texas Data Privacy and Security Act	Tex. Bus. and Com. Code ch. 541	HB 4 (88th Leg., 2023)	Jul 1, 2024	31,709,821
Utah	Utah Consumer Privacy Act	Utah Code 13-61-101 to 13-61-504	Laws 2022, Ch. 462	Dec 31, 2023	3,538,904
Vermont	Vermont Data Privacy and Online Surveillance Act	9 V.S.A. ch. 61A (2415a et seq.)	S.71, Act 145 (2026)	Jan 1, 2028	644,663
Virginia	Consumer Data Protection Act	Va. Code 59.1-575 to 59.1-584	Acts 2021, Sp. Sess. I, cc. 35, 36	Jan 1, 2023	8,880,107

Sector privacy laws that apply regardless of size

The comprehensive laws above are not the whole picture. These narrower laws often reach companies below the thresholds, and data broker registration is a separate regime again; our data brokers list merges the California, Texas and Oregon broker registries.

Illinois Biometric Information Privacy Act (740 ILCS 14). Written notice and release before collecting biometric identifiers; private right of action. $1,000 per negligent violation, $5,000 per intentional or reckless violation (or actual damages); repeat collection from the same person by the same method is one violation.
Washington My Health My Data Act (RCW 19.373). Consumer health data of any business, with no size threshold; bans geofences around in-person health care facilities. Privacy policy duty from March 31, 2024; violations are unfair or deceptive acts under the Consumer Protection Act (ch. 19.86 RCW).
California Age-Appropriate Design Code Act (Cal. Civ. Code 1798.99.28 et seq.). Design duties for online services likely to be accessed by children. Added by Stats. 2022, Ch. 320 (AB 2273).
Maryland Kids Code (Md. Code, Com. Law 14-4801 et seq.). Best-interests-of-children duties for online products reasonably likely to be accessed by children. Subtitle 48 of the Commercial Law Article.
Florida Digital Bill of Rights (Fla. Stat. 501.701 to 501.722). Comprehensive-style rights, but only for very large companies, so most trackers (and this one) exclude it. Controller must make over $1 billion in global gross annual revenue and meet a further test (for example, 50% of revenue from online ads).

What this means for MSPs

Map clients by state, not by size. A 40-person e-commerce client with 40,000 Connecticut or Montana customers is in scope, and in Texas and Nebraska only SBA size standards, not customer counts, decide coverage. Collect resident counts per state during onboarding and rerun the checker each year.
Opt-out signals are now an IT task. 12 in-force laws require honoring universal opt-out signals. Check that client websites, tag managers and consent tools read the Global Privacy Control header and suppress ad and analytics tags when it is present.
Do not plan around cure periods. Most have expired. In Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey and Oregon a regulator can now go straight to an enforcement action.
Sensitive data drives risk. Biometrics, precise location and health data need opt-in consent in most states, and Maryland bans selling sensitive data. Inventory where clients store it alongside the security controls you already run for breach laws; our analysis of how long companies take to report data breaches covers the notification side.
Expect more change. Delaware’s thresholds fall in January 2027, four new laws arrive by 2028, and breach volumes keep rising (see our data breach statistics).

Frequently asked questions

How many states have comprehensive privacy laws in 2026?

23. 19 state laws are in force as of November 2026, and 4 more were signed in 2026: Oklahoma (effective January 1, 2027), Louisiana (January 1, 2027), Alabama (May 1, 2027) and Vermont (January 1, 2028). Florida’s Digital Bill of Rights is usually left out because it reaches only companies with over $1 billion in revenue.

Which state privacy laws took effect in 2026?

Three: Indiana, Kentucky, Rhode Island, all on January 1, 2026. Together they hold 3.7% of the US population. Connecticut’s lower 35,000-consumer threshold also took effect on July 1, 2026.

What share of Americans is covered by a state privacy law?

43.3% of US residents live in a state whose comprehensive privacy law is in force, based on Census Bureau 2025 population estimates. When the four 2026 laws take effect, coverage rises to 47.6%, leaving about 179 million people uncovered.

Which state has the strictest privacy law threshold?

Among laws in force, Texas and Nebraska have no consumer count at all: they reach any business that processes personal data and is not an SBA small business. Connecticut now covers any company that processes sensitive data or sells personal data, and Montana’s main count is the lowest at 25,000 residents. Tennessee is the loosest: over $25 million in revenue plus 175,000 consumers.

Can consumers sue under state privacy laws?

Almost never. Every comprehensive law except California’s either bars a private right of action or, as in Alabama, provides only Attorney General enforcement. California allows suits only for data breaches caused by a failure to maintain reasonable security, with statutory damages of $100 to $750 per consumer per incident (CPI-adjusted).

What are the penalties under state privacy laws?

Most set up to $7,500 per violation. Colorado’s is the highest in force at up to $20,000 per violation, and Alabama’s 2026 law sets up to $15,000. Maryland reaches $25,000 for repeat violations, and Delaware, New Hampshire, Rhode Island and Vermont use $10,000 consumer-protection penalties.

Download the data. us-state-comprehensive-privacy-laws-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

Methodology

Scope. Comprehensive consumer privacy laws: statutes that give residents general rights over personal data (access, deletion, opt-out of sale or targeted advertising) across industries. Sector laws (biometrics, health data, children’s codes) and data broker registration laws are listed separately. Florida’s Digital Bill of Rights is excluded from the count because its controller definition requires over $1 billion in global revenue. Status is as of November 1, 2026.

Sources. For each state we downloaded the enacted act and/or the current official code from the legislature, code reviser or agency site (October 2026), saved the text, and recorded each value with a verbatim quote. A script checks all 407 quotes against the saved texts before the page is built. Where an official site did not respond to our requests (Colorado, Oregon, New Hampshire, Nebraska, Rhode Island, Illinois, the Virginia 2021 act, the Montana 2023 bill and the New Jersey chapter law), we used the Internet Archive’s copy of the same official URL. Law-firm trackers were read only to find bills; no value comes from them.

Definitions. Effective date is the operative date in the enacting act or code note. Thresholds are the main applicability tests. Cure period status is evaluated at November 1, 2026: “discretionary” means the regulator may, but need not, offer a cure. Maximum civil penalty is the base per-violation amount set by the privacy law or the consumer protection statute it cross-references. Population covered uses Census Bureau Vintage 2025 resident population estimates for July 1, 2025 (50 states plus DC = 341,784,857).

Limitations. Our Colorado text is the 2024 Colorado Revised Statutes, so 2025 to 2026 amendments may be missing. Texas and Tennessee values come from the enacted 2023 acts. Montana’s act sets no penalty amount of its own (the Attorney General uses Consumer Protection Act powers), and New Jersey’s penalty is set by its Consumer Fraud Act, whose amount we did not retrieve. Connecticut’s 2026 Public Act 26-64, New Hampshire’s 2026 chapter 168 (effective January 1, 2027) and Virginia’s 2026 chapter 820 are noted but their full text was not reviewed. California’s CPI-adjusted revenue threshold comes from the CPPA’s published adjustment; adjusted fine amounts are not shown. The checker is a simplified screen.

Not legal advice. This is a research summary of public statutes. Confirm obligations with the statute text and counsel.

Cite as:The Uptime Report. "State Privacy Laws 2026: 23 States Have One, but They Still Cover Fewer Than Half of Americans." October 2026. https://theuptimereport.com/state-privacy-laws/

References

Alabama: alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf. Accessed October 2026.
California: cppa.ca.gov/pdf/20260101_ccpa_statute.pdf. Accessed October 2026.
California: cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf. Accessed October 2026.
California: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.12. Accessed October 2026.
California: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.12. Accessed October 2026.
California: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.13. Accessed October 2026.
California: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.14. Accessed October 2026.
California: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.14. Accessed October 2026.
California: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.14. Accessed October 2026.
California: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.15. Accessed October 2026.
California: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.15. Accessed October 2026.
California: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.18. Accessed October 2026.
California: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.19. Accessed October 2026.
California: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.19. Accessed October 2026.
California: www.cppa.ca.gov/regulations/cpi_adjustment.html. Accessed October 2026.
Colorado: leg.colorado.gov/sites/default/files/2021a_190_signed.pdf. Accessed October 2026.
Colorado: leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf. Accessed October 2026.
Connecticut: www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF. Accessed October 2026.
Connecticut: www.cga.ct.gov/2026/sup/chap_743jj.htm. Accessed October 2026.
Connecticut: www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&which_year=2026&bill_n. Accessed October 2026.
Connecticut: www.cga.ct.gov/current/pub/chap_735a.htm. Accessed October 2026.
Connecticut: www.cga.ct.gov/current/pub/chap_743jj.htm. Accessed October 2026.
Delaware: delcode.delaware.gov/sessionlaws/ga152/chp197.shtml. Accessed October 2026.
Delaware: delcode.delaware.gov/title6/c012d/index.html. Accessed October 2026.
Delaware: delcode.delaware.gov/title6/c025/sc02/index.html. Accessed October 2026.
Indiana: iga.in.gov/ic/2026/Title_24.pdf. Accessed October 2026.
Iowa: www.legis.iowa.gov/docs/acts/2023/CH0017.pdf. Accessed October 2026.
Iowa: www.legis.iowa.gov/docs/code/715D.pdf. Accessed October 2026.
Kentucky: apps.legislature.ky.gov/law/statutes/statute.aspx?id=55839. Accessed October 2026.
Kentucky: apps.legislature.ky.gov/law/statutes/statute.aspx?id=55844. Accessed October 2026.
Kentucky: apps.legislature.ky.gov/law/statutes/statute.aspx?id=56648. Accessed October 2026.
Kentucky: apps.legislature.ky.gov/recorddocuments/bill/26RS/hb692/bill.pdf. Accessed October 2026.
Louisiana: legis.la.gov/Legis/LawPrint.aspx?d=104031. Accessed October 2026.
Louisiana: legis.la.gov/legis/BillInfo.aspx?s=26RS&b=SB386&sbi=y. Accessed October 2026.
Louisiana: legis.la.gov/legis/ViewDocument.aspx?d=1480202. Accessed October 2026.
Maryland: mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541E.pdf. Accessed October 2026.
Maryland: mgaleg.maryland.gov/2026RS/Chapters_noln/CH_874_hb0711t.pdf. Accessed October 2026.
Maryland: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=13-410&enactments=fals. Accessed October 2026.
Maryland: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4702&enactments=fal. Accessed October 2026.
Maryland: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4703&enactments=fal. Accessed October 2026.
Maryland: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4707&enactments=fal. Accessed October 2026.
Maryland: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4713&enactments=fal. Accessed October 2026.
Maryland: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4714&enactments=fal. Accessed October 2026.
Minnesota: www.revisor.mn.gov/laws/2024/0/Session+Law/Chapter/121/. Accessed October 2026.
Minnesota: www.revisor.mn.gov/statutes/cite/325M/full. Accessed October 2026.
Montana: archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-. Accessed October 2026.
Montana: archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0040/0300-0140-0280-. Accessed October 2026.
Montana: archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0090/0300-0140-0280-. Accessed October 2026.
Montana: archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0120/0300-0140-0280-. Accessed October 2026.
Montana: archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0170/0300-0140-0280-. Accessed October 2026.
Montana: leg.mt.gov/bills/2023/billpdf/SB0384.pdf. Accessed October 2026.
Nebraska: nebraskalegislature.gov/laws/statutes.php?statute=87-1103. Accessed October 2026.
Nebraska: nebraskalegislature.gov/laws/statutes.php?statute=87-1111. Accessed October 2026.
Nebraska: nebraskalegislature.gov/laws/statutes.php?statute=87-1112. Accessed October 2026.
Nebraska: nebraskalegislature.gov/laws/statutes.php?statute=87-1118. Accessed October 2026.
Nebraska: nebraskalegislature.gov/laws/statutes.php?statute=87-1122. Accessed October 2026.
Nebraska: nebraskalegislature.gov/laws/statutes.php?statute=87-1124. Accessed October 2026.
Nebraska: nebraskalegislature.gov/laws/statutes.php?statute=87-1125. Accessed October 2026.
Nebraska: nebraskalegislature.gov/laws/statutes.php?statute=87-1128. Accessed October 2026.
New Hampshire: gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm. Accessed October 2026.
New Hampshire: gc.nh.gov/rsa/html/XXXI/358-A/358-A-4.htm. Accessed October 2026.
New Jersey: pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM. Accessed October 2026.
Oklahoma: webserver1.lsb.state.ok.us/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF. Accessed October 2026.
Oklahoma: www.oklegislature.gov/BillInfo.aspx?Bill=SB546&Session=2600. Accessed October 2026.
Oregon: olis.oregonlegislature.gov/liz/2023R1/Downloads/MeasureDocument/SB619/Enrolled. Accessed October 2026.
Oregon: www.oregonlegislature.gov/bills_laws/ors/ors646a.html. Accessed October 2026.
Rhode Island: webserver.rilegislature.gov/Statutes/TITLE6/6-13.1/6-13.1-8.htm. Accessed October 2026.
Rhode Island: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-2.htm. Accessed October 2026.
Rhode Island: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm. Accessed October 2026.
Rhode Island: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm. Accessed October 2026.
Rhode Island: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-5.htm. Accessed October 2026.
Rhode Island: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm. Accessed October 2026.
Tennessee: publications.tnsosfiles.com/acts/113/pub/pc0408.pdf. Accessed October 2026.
Texas: capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf. Accessed October 2026.
Utah: le.utah.gov/xcode/Title13/Chapter61/C13-61_2022050420231231.pdf. Accessed October 2026.
Vermont: legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf. Accessed October 2026.
Vermont: legislature.vermont.gov/statutes/section/09/063/02458. Accessed October 2026.
Virginia: law.lis.virginia.gov/vacodefull/title59.1/chapter53/. Accessed October 2026.
Virginia: legacylis.virginia.gov/cgi-bin/legp604.exe?212+ful+CHAP0036. Accessed October 2026.
Illinois Biometric Information Privacy Act: www.ilga.gov/legislation/ilcs/documents/074000140K20.htm. Accessed October 2026.
Washington My Health My Data Act: app.leg.wa.gov/rcw/default.aspx?cite=19.373&full=true. Accessed October 2026.
California Age-Appropriate Design Code Act: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99. Accessed October 2026.
Maryland Kids Code: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4801&enactments=fal. Accessed October 2026.
Florida Digital Bill of Rights: www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Section. Accessed October 2026.
US Census Bureau, Vintage 2025 state population estimates: NST-EST2025-ALLDATA.csv. Accessed October 2026.

Research library

More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

Threats and breaches

IC3 Report 2025
IC3 losses, crime types, states per capita
AI Incidents Statistics 2026
AI incidents by year, harm type, company
Cyber Attacks 2026
Every 2026 cyber attack, primary-sourced
WordPress Vulnerabilities
WordPress plugin, theme and core CVEs
Hypervisor Vulnerabilities
Hypervisor CVEs vs exploitation
DMARC Adoption Statistics 2026
DMARC enforcement, 15,000 domains
RMM Vulnerabilities and Remote Access Flaws
RMM and remote access flaws in KEV
Identity Theft Statistics 2026
ID theft per 100K by state and type
Scam Statistics 2026
FTC fraud losses by channel and age
VPN Vulnerabilities by Vendor
VPN gateway KEV and CVEs by vendor
MFA Statistics 2026
MFA methods across 2,571 services
Password Statistics 2026
12,674 passwords tested against HIBP
Ransomware Groups 2026
Most active ransomware groups, ranked
Ransomware Statistics 2026
Leak-site victims by month since 2021
Malicious npm Packages
Malicious npm packages, day by day
Cybersecurity Statistics 2026
70 sourced stats, every number traced
Zero-Day Statistics
Every tracked zero-day since 2014
Phishing Statistics 2026
Four phishing measures, one evidence board
Patch Tuesday Statistics 2026
Every Microsoft CVE since 2021
Disaster Declarations by State
FEMA data for continuity planning
Data Breach Statistics 2026
980 breaches in Have I Been Pwned
Ransomware Initial Access Vectors
CISA advisories coded by entry technique
CVE Statistics 2026
Vulnerabilities published per year, NIST NVD
How Long Do Companies Take to Report a Data Breach?
1,675 Washington notices
Known Exploited Vulnerabilities
The CISA KEV catalog analyzed
Healthcare Data Breach Report 2026
HHS OCR breach portal scorecard
Ransomware Reported to the FBI
Five-year IC3 trend

Infrastructure and uptime

OpenAI Outage History
1,051 OpenAI incidents, causes coded
Data Center Construction Spending 2026
Data center build spending, Census monthly
Microsoft End of Support 2026
Every 2026 Microsoft support cutoff
Fiber Internet Availability by State 2026
Fiber by state, build pace, top providers
5G Coverage Map 2026
5G by state and carrier, FCC data
Cell Phone Outage History
FCC outages, DIRS cell sites, 911 fines
Mac Market Share 2026
Mac desktop share by country and version
Browser Market Share 2026
Browser share since 2009, by platform
Microsoft 365 Market Share 2026
Who runs email: Microsoft vs Google
CrowdStrike Outage
July 19, 2024 outage, minute by minute
Data Center Electricity Prices 2026
Power prices vs data center load, by state
Average Internet Bill 2026
Home internet prices by speed and state
Search Engine Market Share 2026
Search share since 2009, by country
ChatGPT Market Share 2026
AI chatbot referral share, every tracker
Google Cloud Outage History
Google Cloud incidents by product, 2013 on
Azure Outage History
Every Azure PIR, coded by root cause
Data Center Water Usage 2026
Water by site, company and drought
AI Energy Consumption 2026
Big Tech electricity vs US demand
SSD Prices 2026
NAND price cycle from makers’ filings
RAM Prices 2026
DRAM prices from producers’ filings
Domain Name Statistics 2026
Domains by TLD, renewals, registrars
Linux Market Share 2026
Linux desktop share, every headline traced
GitHub Outages
GitHub incidents by month since 2020
Cloudflare Outage History
Every Cloudflare outage post-mortem
Starlink Statistics 2026
Satellites, subscribers, coverage, outages
Internet Access Statistics 2026
Home internet gaps by state and group
SQL Server End of Life
SQL Server support countdown + CVEs
Windows 11 Market Share 2026
Windows 10 vs 11 share by country
Cloud Computing Statistics 2026
Hyperscaler revenue and capex, SEC data
AWS Outage History
Every AWS Post-Event Summary since 2011
Data Centers by State 2026
Sites, jobs, power for every state
Data Center Statistics 2026
Data center power, spending, jobs
99.9% Uptime
Uptime calculator and 35 real SLAs
Power Outage Statistics by State
Outage hours by state, EIA data
Cost of Downtime
Revenue per hour for 3,001 public companies
Windows Server End of Life
Support dates and CVEs per server version

Regulation and disclosure

State AI Laws 2026
131 state AI laws, dates and penalties
FedRAMP Statistics 2026
FedRAMP authorizations, GSA data
Item 1C Cybersecurity Disclosures
What 600 10-Ks say in Item 1C
CMMC Certification Statistics 2026
CMMC demand vs assessor capacity
Data Brokers List 2026
728 brokers across three state registries
SEC Cybersecurity Incident Disclosures
Every 8-K Item 1.05 filing
HIPAA Enforcement Tracker
Every OCR penalty and settlement

Workforce and pay

Most Popular Programming Languages 2026
Language ranks by country, GitHub data
Computer Science Graduates Per Year
CS degrees per year, IPEDS 2011 to 2024
Data Scientist Salary 2026
Data scientist pay ladder and metros, BLS
Web Developer Salary 2026
Web dev vs software pay by state, BLS
AI at Work Statistics 2026
Worker AI use: ever, weekly, daily, by job
Network Engineer Salary 2026
Network engineer vs admin pay, BLS
IT Manager Salary 2026
IT manager pay by industry, BLS OEWS
Software Engineer Salary 2026
Developer pay by metro, BLS OEWS
H-1B Statistics 2026
H-1B lottery, employers, and wages
AI Layoffs 2026
AI-blamed job cuts, sourced to filings
Help Desk Salary 2026
Help desk hourly pay, BLS OEWS
Cybersecurity Salary 2026
Security pay percentiles, BLS OEWS
Women in Tech Statistics 2026
Women’s share of tech jobs since 2011
IT Unemployment Rate 2026
Tech vs national jobless rate, monthly
Tech Job Postings 2026
Tech postings vs 2020, by role and country
Tech Layoffs 2026
Tech layoffs from state WARN notices
Remote Work Statistics 2026
Telework by job, industry, and state
Highest Paying Cities for IT Jobs 2026
Metro pay by role, BLS OEWS
The Tech Job Market in 2026
Openings, quits, hires, layoffs
IT Salaries by State 2026
Pay matrix for four IT roles
IT and Cybersecurity Jobs Outlook 2026
BLS employment projections

MSP market and spending

AI Capex 2026
Big Tech capex vs cash flow, SEC data
Cybersecurity Budget 2027
Federal and CISA cyber budgets, benchmarks
Microsoft 365 Price Increase 2026
Every M365 price change, vs inflation
Computer Prices 2026
Computer price indexes and HS 8471 imports
MSP Market Size 2026
Managed services market, built from Census
Small Business AI Adoption 2026
AI use by firm size, sector, state, Census
Cyber Insurance Statistics
Cyber insurance market, NAIC 2015-2024
IT Spending by Industry
IT investment by industry, BEA
IT Services Industry Growth 2026
Census revenue by service industry
IT Hourly Rates 2026
Hourly IT labor rates, GSA contracts
VoIP Statistics 2026
Business VoIP vs landlines, FCC
MSP Industry Statistics 2026
Jobs, wages, and firms, BLS QCEW
Federal IT Spending 2026
IT services contracts, USAspending
IT Services Firms by State
Census business patterns atlas

State Privacy Laws 2026: 23 States Have One, but They Still Cover Fewer Than Half of Americans

Coverage over time: from one state in 2020 to under half the country

Which state privacy laws took effect in 2026, and what changed

Comparison matrix: all 23 state privacy laws

Strictest and loosest thresholds

Strictest (easiest to fall into)

Loosest (hardest to trigger)

Applicability checker

All 23 laws: names, citations and enacting acts

Sector privacy laws that apply regardless of size

What this means for MSPs

Frequently asked questions

How many states have comprehensive privacy laws in 2026?

Which state privacy laws took effect in 2026?

What share of Americans is covered by a state privacy law?

Which state has the strictest privacy law threshold?

Can consumers sue under state privacy laws?

What are the penalties under state privacy laws?

Methodology

References

Research library

Comments

Leave a Reply Cancel reply

More posts

State AI Laws in 2026: 131 Enacted Laws in 36 States, and Colorado Rewrote Its Landmark Act Before Anyone Enforced It

State Privacy Laws 2026: 23 States Have One, but They Still Cover Fewer Than Half of Americans

WordPress Vulnerabilities: 10,943 CVEs in 2026 So Far, 90% in Plugins, and 3 Core Flaws Now Exploited

Browser Market Share 2026: Chrome 66.5%, Safari 18.2%, and a Year of Chrome Gains Gone in One Month